Why does my AI SOC flag a simple NaCl precipitation as a malicious code injection?

I tried to be clever and fed my custom AI incident correlator the same naming conventions I use in the chemistry lab.

When my router dumped a packet payload that contained the string "NaCl_precip" – just a debug flag I added while testing a cheap humidity sensor coolant (10 mM NaCl solution) – the model classified it as "potential foreign code injection" and escalated it to the SOC.

I pushed the alert straight to production because the AI vendor swore it was a "zero‑day detection". Result: a full‑blown panic, half the shift hunting for a non‑existent breach, and me having to explain that we literally mixed table salt in a cooling loop.

The vendor now claims the false positive proves their platform "catches subtle threat vectors", while my team wonders if they can actually distinguish between HCl acid wash logs and real exploits.

Anyone else let a chemistry joke break their security tooling? How do you stop AI from treating every lab‑sourced identifier as an attack vector?